nmap2certs

#!/usr/bin/env ruby

$stderr.sync = true

begin
  require 'nmap/xml'
rescue LoadError
  STDERR.puts "The ruby-nmap gem could not be loaded, is it installed?"
  STDERR.puts "-> gem install ruby-nmap"
  exit
end
begin
  require "docopt"
rescue LoadError
  STDERR.puts "The docopt gem could not be loaded, is it installed?"
  STDERR.puts "-> gem install docopt"
  exit
end
require "set"

doc = <<DOCOPT
Parse nmap xml output and print out certificates enuemrated by the ssl-cert NSE script.

Usage:
  #{__FILE__} <xml>...
  #{__FILE__} -h | --help

Options:
  -h --help     Show this output.

DOCOPT

begin
  options = Docopt::docopt(doc)
rescue Docopt::Exit => e
  STDERR.puts e.message
  exit
end

# check arguments

options['<xml>'].each do |file|
  if not File.exists?(file)
    STDERR.puts "[!] #{file} does not exist!"
    exit 1
  end
end

# variables

targets = Hash.new

# process nmap xml files

options['<xml>'].each do |nmap|
  Nmap::XML.new(nmap) do |xml|
    xml.each_host do |host|

      unless targets.include? host.ip
        targets[host.ip] = SortedSet.new
      end

      host.each_port do |port|
        port.scripts.each do |name, output|
          next unless name == "ssl-cert"
          output.each_line do |line|
            if line.include? "Subject: commonName="
              cert = line.split("=", 2).last.strip
              if cert.include? "/"
                targets[host.ip] << cert.split("/", 2).first
              else
                targets[host.ip] << cert
              end
            elsif line.include? "Subject Alternative Name:"
              cert = line.split(":", 2).last.strip
              if cert.include? ","
                cert.split(",").each do |san|
                  if san.include? "DNS:"
                    targets[host.ip] << san.split(":").last.strip
                  end
                end
              else
                targets[host.ip] << cert.strip
              end
            end
          end
        end
      end
    end
  end
end

targets.each do |ip, hostnames|
  hostnames.each do |hostname|
    puts "#{ip},#{hostname}"
  end
end